ToFu: Exploiting and Fuzzing the LLM–Orchestrator–Tool Trust Boundary

What it is

ToFu is a Python fuzzing framework (built on Atheris/libFuzzer, with a JS runner) that tests LLM tool implementations, mainly MCP servers, against security contracts derived from each argument's own metadata. It adds oracles for bugs that return normally instead of crashing. The page's real value for an engineer is what it says about which bug classes are common, what the tool misses, and how to run this kind of test safely.

How it works

• An LLM does two jobs per tool: it picks sanitizers from the 74-entry corpus, and it adapts seed payloads to the tool's schema. It never judges a result.
• Introspector sanitizers read events from 21 Python tracers hooked on sinks such as open, subprocess and socket. Outcome sanitizers flag an adversarial input and report a bug if the tool returns success.
• For each selected outcome sanitizer, the LLM writes an on_trigger rule: raise_exception, allow_success_with_fallback, or allow_success_always.
• Of the 74 sanitizers, 11 always run, 35 run when their evidence appears, and 27 run only when the LLM selects them.

Findings that change what you check

Verified bug classes, from the page's breakdown of the 253 bugs:

• At the 60 s per-tool budget, ToFu finds 231 of the 253 bugs. The other 22 need runs of between 111 s and 70 minutes.
• Of 508 initial candidates, 326 showed the dangerous operation or an unescaped value directly. In the other 182 the input violated a constraint but the tool simply reported success.
• Baselines on the same 273 servers:

• VIPER-MCP's agent stage confirmed exploits in 11 servers. ToolFuzz flagged 92 servers, but it tests documentation correctness, not security. Eight servers were flagged only by ToFu.
• The page reports agreement on shared arguments (path traversal, command injection) and says the analyzers otherwise measure different things.

Preconditions / Affected

• The tool must actually execute. Of 482 buildable servers, only 273 were cleanly executable, with no missing credentials or backends. Sitecore ran 123 tools but only one succeeded.
• Introspection covers in-process Python targets only. JavaScript targets get outcome checks only.
• The page names six orchestrators where Repeat-After-Me reproduced: LangGraph, MAF, ADK 2.0, AutoGen, Strands and CrewAI. The attacker needs to know the orchestrator's tool-call format.

What to do

• Treat every schema-valid argument as attacker-controlled, and validate paths, URLs and commands inside the tool. Don't rely on the LLM or orchestrator.
• Fuzz inside a sandbox. The page used bubblewrap with a read-only root and a private /tmp. Four servers affected the host during fuzzing:
• UltimateCoderMCP deleted files outside its workspace.
• obsidian-mcp followed a fuzzed path outside its vault.
• tmux-mcp killed sessions it did not own.
• DesktopCommanderMCP spawned processes without limit.
• Don't enable all 74 sanitizers on every tool. Doing so more than doubled reports, and over 90% were false on the tools only that arm flagged. Throughput was unchanged at about 43 executions per second.
• Supply valid identifiers and credentials as seeds, since unreachable logic is the main miss. About 63% of baseline-flagged servers that ToFu missed failed at startup or rejected every input early.
• Pair it with static tools. About a fifth of baseline-only servers had permissive CORS, bad sanitizing regexes or filesystem races.

Caveats

• The 253 bugs were hand-verified, but the page gives no disclosure or fix status.
• Selection misses real bugs. The all-sanitizers run found 13 that ToFu missed in five servers, including five SSRF in one WordPress server. The LLM chose a Python-only SSRF tracer for a JS target.
• Intentional code runners (python_repl, applescript_execute) are not flagged by design. VIPER-MCP counted these as exploits.
• Replication is noisy. Across three full runs, only 342 bugs appeared in all three, with Jaccard overlap of 0.75–0.81 between runs.
• Ablation numbers were not hand-verified.
• The fetched text was truncated at 60,000 of 91,363 characters. It cuts off in the Discussion section, so the later content, including limitations and the appendices, was not seen.